CVE-2025-9078

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.8.x through 10.8.3 Mattermost versions 10.5.x through 10.5.8 Mattermost versions 9.11.x through 9.11.17 Mattermost versions 10.10.x through 10.10.1 Mattermost versions 10.9.x through 10.9.3

Description The Mattermost application does not properly validate cache keys for link metadata. This allows authenticated users to access unauthorized posts and manipulate link previews through hash collision attacks on the FNV-1 hashing function.

Recommendations Update Mattermost to a version later than 10.8.3. Update Mattermost to a version later than 10.5.8. Update Mattermost to a version later than 9.11.17. Update Mattermost to a version later than 10.10.1. Update Mattermost to a version later than 10.9.3.